The Transparent Vault
Ubuntu uses a system called GNOME Keyring to securely store passwords for your Wi-Fi networks, email accounts, and SSH keys. To make the user experience seamless, Ubuntu is configured by default to automatically unlock this entire keyring the moment you log into your user account using your login password. While incredibly convenient, this means that if someone gains access to your unlocked desktop (e.g., if you step away without locking your screen, or if someone compromises your user session), they have immediate, unfettered access to every single saved password in your vault without needing a secondary prompt.
Enforcing a Secondary Password
To maximize security and stop Ubuntu from automatically unlocking your GNOME Keyring upon login, you must change the keyring password so that it differs from your primary user account login password.
Open the GNOME application launcher and search for Passwords and Keys (this application is sometimes called Seahorse). Open it. In the left-hand sidebar, under “Passwords,” you will see a folder called Login (which is the default keyring). Right-click the Login folder and select Change Password. The system will prompt you to enter your current “Old password” (which is your current Ubuntu login password). Next, it will ask for a “New password.” Enter a completely different, highly secure password here and confirm it. Click Change. Now, when you reboot and log into Ubuntu, your desktop will load, but the vault remains locked. The first time an application (like your browser or Wi-Fi manager) requests a password, you will be explicitly prompted to enter this new, secondary keyring password.